# -*- coding: utf-8 -*-
import re
import os

def get_ld_so_preload():
    if os.path.exists('/etc/ld.so.preload') :
        with open('/etc/ld.so.preload', encoding='utf-8') as file:
            preload = file.readlines()
    else:
        print("haha")
        preload = []
    return preload

def strings(file) :
    chars = r"A-Za-z0-9/\-:.,_$%'()[\]<> ";
    shortestReturnChar = 4;
    regExp = '[%s]{%d,}' % (chars, shortestReturnChar)
    pattern = re.compile(regExp)
    with open(file, 'rb') as f:
        data = f.read()
        data = data.decode(encoding='ISO-8859-1')
        return pattern.findall(data)
 
if __name__ == "__main__":
    # 一些敏感的hook函数
    sensitive_func = [
        "dlsym", 
        "execve",
        "access", "open", "readdir", "fopen", "opendir", "fdopendir",  "readdir64", "open64",  "fopen64", 
        "unlinkat", "unlink", "link", "symlink", "rmdir", "write", "kill", "rename", 
        "stat", "lstat", "lxstat", "xstat", "__xstat", "__fxstat",
        "chmod", "chdir", "lchmod", "fchmod", "chown", "lchown", 
        "ptrace", "getgid", "getregid"
        ]
    
    preload = get_ld_so_preload()
    evil_so = {}
    for file in preload:
        file = file.strip("\n")
        evil_so[file] = []
        funcs = strings(file)
        for func in funcs:
            if func in sensitive_func :
                evil_so[file].append(func)
        
    for key in evil_so.keys():
        print("")
        print("ld.so.preload:")
        print(key)
        print("")
        print("sensitive func:")
        print(str(evil_so[key]))
        print("\n")